alexdtn vulnerabilities

Products

• Simple AL Slider 2
• animated al list 1
• Subitem AL Slider 1

Latest alexdtn CVEs

Newest publication first

1. CVE-2026-1634 Subitem AL Slider <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']

   Published 2026-02-07

   Medium·CVSS 6.1 EPSS 0.30%

   The Subitem AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated att...

2. CVE-2025-14137 Simple AL Slider <= 1.2.10 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']

   Published 2025-12-12

   Medium·CVSS 6.1 EPSS 0.27%

   The Simple AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] variable in all versions up to, and including, 1.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated atta...

3. CVE-2024-5728 Animated AL List <= 1.0.6 - Reflected XSS

   Published 2024-06-28

   Medium·CVSS 5.4 EPSS 0.48%

   The Animated AL List WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

4. CVE-2024-5729 Simple AL Slider <= 1.2.10 - Reflected XSS

   Published 2024-06-28

   Medium·CVSS 6.1 EPSS 0.48%

   The Simple AL Slider WordPress plugin through 1.2.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.